Check your htaccess file. And look for hacked files: plugins/themes/etc; and update everything (including your PHP version). Change credentials everywhere (not just WP) using strong passwords.
Make sure your site is clean – there are many ways to insert code into a WP site (even the wp-config.php file may not be ‘clean’).
I use my own procedure to clean client sites: https://www.securitydawg.com/recovering-from-a-hacked-wordpress-site/ . There are many googles/bings/ducks on how to de-hack sites.